Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

WordPress 6.4.2 Patches Remote Code Execution Vulnerability

WordPress 6.4.2 patches a flaw that could be chained with another vulnerability to execute arbitrary code.

WordPress this week released a security update for the popular content management system (CMS) to address a remote code execution (RCE) vulnerability.

The flaw addressed in the open source CMS is a property oriented programming (POP) chain issue introduced in WordPress core 6.4. It can be combined with a different object injection flaw, allowing attackers to execute PHP code on vulnerable websites.

The bug was identified in a class that was introduced in WordPress 6.4 to improve HTML parsing in the block editor, the Wordfence team at WordPress security company Defiant explains.

The vulnerable class includes a function that is executed automatically after PHP has processed a request, and which uses properties that an attacker may have full control of.

“While WordPress Core currently does not have any known object injection vulnerabilities, they are rampant in other plugins and themes. The presence of an easy-to-exploit POP chain in WordPress core substantially increases the danger level of any Object Injection vulnerability,” Wordfence explains.

In its advisory, WordPress notes that the RCE flaw is not exploitable directly in core, but that, when combined with some plugins, it may pose a high risk.

To resolve the issue, WordPress added a new method that prevents the vulnerable function from executing, thus preventing exploitation.

The RCE bug was patched in WordPress 6.4.2. Site owners and administrators are advised to update to the fixed CMS version as soon as possible.

Advertisement. Scroll to continue reading.

While there are no indicators that the vulnerability is being exploited in malicious attacks, bugs in WordPress and associated plugins have long been an attractive target for threat actors.

“While most sites should automatically update to WordPress 6.4.2, we strongly recommend manually checking your site to ensure that it is updated,” Wordfence notes.

Related: Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin

Related: Recently Patched TagDiv Plugin Flaw Exploited to Hack Thousands of WordPress Sites

Related: Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks

Related: Critical WordPress Plugin Vulnerabilities Impact Thousands of Sites

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.